Cloudanix VulnDB

CVE-2025-40355

None

CVSS

—

EPSS

0.2%

Published

Dec 16, 2025

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A kernel bug can generate warnings when network settings move between isolated environments, which might complicate troubleshooting on servers running containers or virtual machines.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits __dev_change_net_namespace to attempt ownership changes on sysfs group attributes without first invoking is_visible, triggering WARN_ON when attributes are hidden during net namespace transitions.

Why it matters to the business

Kernel warnings and potential instability may occur during network namespace operations common in container and virtualization workloads, raising maintenance overhead on affected Linux systems without immediate service outages.

How an attack unfolds

An attacker with netlink privileges issues rtnl_newlink or equivalent operations that invoke namespace changes; the missing visibility check causes the kernel to hit the WARN_ON path in attribute ownership modification.

How to fix it

Apply the upstream fix in commit ac2c526e103285d80a0330b91a318f6c9276d35a or update affected Red Hat packages to version 2:2.0.0-46.rc4.el8_1.1 for freerdp and libwinpr components.

How to confirm the fix worked

Confirm the is_visible check precedes attribute ownership changes in sysfs handling, then execute network namespace migration tests to verify absence of the WARN_ON trace.

Typical attack path

  1. Obtain capability to send netlink messages or perform link configuration
  2. Trigger device namespace reassignment via do_setlink or rtnl_newlink
  3. Cause evaluation of non-visible sysfs attributes leading to the warning condition

How to detect it

Search kernel logs and dmesg for the specific WARN_ON signature at net/core/dev.c involving __dev_change_net_namespace and sysfs visibility failures during netlink activity.

What your security team should do

  • Prioritize kernel and package updates to the listed fixed versions
  • Enable kernel panic_on_warn or enhanced logging for dev.c warnings during namespace operations
  • Audit container and virtualization platforms for frequent net namespace usage

The record

In the Linux kernel, the following vulnerability has been resolved: sysfs: check visibility before changing group attribute ownership Since commit 0c17270f9b92 ("net: sysfs: Implement is_visible for phys_(port_id, port_name, switch_id)"), __dev_change_net_namespace() can hit WARN_ON() when trying to change owner of a file that isn't visible. See the trace below: WARNING: CPU: 6 PID: 2938 at net/core/dev.c:12410 __dev_change_net_namespace+0xb89/0xc30 CPU: 6 UID: 0 PID: 2938 Comm: incusd Not tainted 6.17.1-1-mainline #1 PREEMPT(full) 4b783b4a638669fb644857f484487d17cb45ed1f Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.07 02/19/2025 RIP: 0010:__dev_change_net_namespace+0xb89/0xc30 [...] Call Trace: <TASK> ? if6_seq_show+0x30/0x50 do_setlink.isra.0+0xc7/0x1270 ? __nla_validate_parse+0x5c/0xcc0 ? security_capable+0x94/0x1a0 rtnl_newlink+0x858/0xc20 ? update_curr+0x8e/0x1c0 ? update_entity_lag+0x71/0x80 ? sched_balance_newidle+0x358/0x450 ? psi_task_switch+0x113/0x2a0 ? __pfx_rtnl_newlink+0x10/0x10 rtnetlink_rcv_msg+0x346/0x3e0 ? sched_clock+0x10/0x30 ? __pfx_rtnetlink_rcv_msg+0x10/0x10 netlink_rcv_skb+0x59/0x110 netlink_unicast+0x285/0x3c0 ? __alloc_skb+0xdb/0x1a0 netlink_sendmsg+0x20d/0x430 ____sys_sendmsg+0x39f/0x3d0 ? import_iovec+0x2f/0x40 ___sys_sendmsg+0x99/0xe0 __sys_sendmsg+0x8a/0xf0 do_syscall_64+0x81/0x970 ? __sys_bind+0xe3/0x110 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? sock_alloc_file+0x63/0xc0 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? alloc_fd+0x12e/0x190 ? put_unused_fd+0x2a/0x70 ? do_sys_openat2+0xa2/0xe0 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> Fix this by checking is_visible() before trying to touch the attribute.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 5.7.0 6.17.6
openSUSE:Leap 16.0 dtb-aarch64 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-64kb 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-azure 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-default 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-default-base 0 6.12.0-160000.9.1.160000.2.6
openSUSE:Leap 16.0 kernel-docs 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-kvmsmall 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-obs-build 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-obs-qa 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-rt 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-source 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-syms 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-zfcpdump 0 6.12.0-160000.9.1

Related vulnerabilities